Command-line tool to obtain OUI vendor info from MAC address?

I do not think there is an automated tool to do what you ask, but can be done by working directly on files oui.txt.

First of all it identifies the file downloaded, for example: 

root@kalilloX:~# locate oui.txt
/var/lib/ieee-data/oui.txt

then search for the string you are interested. You must remove : or instead insert a -:

root@kalilloX:~# grep -i "44d9e7" /var/lib/ieee-data/oui.txt
44D9E7     (base 16)        Ubiquiti Networks, Inc.

A similar answer to the one of LilloX, but using nMap (if installed in the system):

luis@balanceador:~$ locate nmap-mac-prefixes
/usr/share/nmap/nmap-mac-prefixes
luis@balanceador:~$ grep 0024A5 -i /usr/share/nmap/nmap-mac-prefixes
0024A5 Buffalo

Supposedly working with any other program that stores OUI info, like airodump-ng-oui-update (to oui.txt file in this case), or several others:

  • /usr/share/btscanner/oui.txt
  • /usr/share/bluelog/oui.txt
  • /usr/share/ieee-data/oui.txt
  • /usr/share/golismero/thirdparty_libs/netaddr/eui/oui.txt
  • /usr/share/metasploit-framework/vendor/bundle/ruby/2.1.0/gems/packetfu-1.1.11/examples/oui.txt
  • /etc/unicornscan/oui.txt
  • /var/lib/ieee-data/oui.txt

Cross-Distro Fully Automated Solution:

The following script automates the process and works across all Linux distros because it has no dependencies on specialized packages. It simply parses the output of the ip command, isolates the vendor part of mac address into a variable which is finally grep'ed through an online DB of vendor prefixes.

#!/bin/bash

OUI=$(ip addr list|grep -w 'link'|awk '{print $2}'|grep -P '^(?!00:00:00)'| grep -P '^(?!fe80)' | tr -d ':' | head -c 6)

curl -sS "http://standards-oui.ieee.org/oui.txt" | grep -i "$OUI" | cut -d')' -f2 | tr -d '\t'

With a bit of creativity you could adapt this to execute remotely via ssh. I've seen other suggestions to identify vendor details using dmidecode for OS fingerprinting, but experienced inconsistent results with that tool when testing. On Raspberry Pi dmidecode fails totally. HTH-

Tags:

Mac Address

Recent Posts